dw-sdlc 0.0.0-stage → 0.1.0

package/dist/commands/setup.js

@@ -0,0 +1,369 @@
+// `dw-sdlc setup` sets a repository and this machine up for the guardrails plugin. Four files, each
+// written only when its content would change, so a repeat with nothing changed is silent and a run is
+// safe to repeat:
+//
+//   .ai/agentic.config.local.json   the machine's layer, from inference: the Node package manager when
+//                                   the committed config leaves it unset, $schema at the marketplace
+//                                   clone's schema, commit.convention when --convention names one
+//                                   or the file already pins one, and the guardrails block the file
+//                                   holds, as it is. Refused when one exists with other content than
+//                                   those, unless --force.
+//   .git/info/exclude               keeps that file and .claude/settings.local.json out of git without
+//                                   touching the repository's tracked .gitignore
+//   .claude/settings.local.json     permissions.deny as the jq-less backstop for the hooks: the
+//                                   destructive git and gh sets in plain and rtk form, and Read/Edit
+//                                   rules for every env file the resolved guardrails.envFiles refuses:
+//                                   listed in deny, or ignored by git and not listed in allow
+//   ~/.claude/settings.json         autoMode.allow plus the lease-push exception ("$defaults" opens a
+//                                   list this run creates), and permissions.deny with the irreversible set;
+//                                   under $CLAUDE_CONFIG_DIR when it is set, as Claude Code reads it
+//
+// Existing content is merged, never replaced: lists grow by the entries they lack, the repository's
+// deny list loses the rules RETIRED_DENY names, other keys stay. A settings file that is not JSON is
+// refused, not rewritten. From a linked worktree all three repository files go to the main checkout:
+// every worktree reads the local config from there when it has none of its own, and Claude Code reads
+// the local settings there. The only thing run in the repository is read-only git.
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, relative } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { COMMIT_CONVENTIONS, COMMITTED_FILE, DEFAULT_GUARDRAILS, LOCAL_FILE, SCHEMA_FILE, STRICTNESS, inferConfig, repositoryRoot, schemaId, validateDocument } from "../agentic-config.js";
+import { GLOBAL_DENY, LEASE_RULE, RETIRED_DENY, repositoryDeny } from "../setup-rules.js";
+export const summary = "write this machine's local config layer, the git excludes and the permission rules";
+const USAGE = `Usage: dw-sdlc setup [--root <dir>] [--home <dir>]
+       [--convention <preset>] [--force-push deny|ask|lease] [--commit-on-protected deny|allow]
+       [--force] [--dry-run]
+  or:  pnpm guardrails:setup with the same flags, in a checkout of dw-sdlc
+
+Writes .ai/agentic.config.local.json from inference, excludes it in .git/info/exclude, generates
+permissions.deny into .claude/settings.local.json, and adds the lease-push exception and the
+irreversible deny set to ~/.claude/settings.json, or $CLAUDE_CONFIG_DIR/settings.json without
+--home. From a linked worktree the repository's files go to the main checkout. Every file is
+written only when it would change; --convention ticket-key | conventional pins commit.convention in
+the local config, and a run without it keeps the pin as it is; a guardrails block in the local config
+is kept, and --force-push and --commit-on-protected pin those two keys in it, refused where they would
+loosen what the committed config sets; --force overwrites a local config that differs in anything
+else; --dry-run reports without writing.`;
+function isConvention(value) {
+    return COMMIT_CONVENTIONS.some((preset) => preset === value);
+}
+function isForcePush(value) {
+    return STRICTNESS.forcePush.some((item) => item === value);
+}
+function isCommitOnProtected(value) {
+    return STRICTNESS.commitOnProtected.some((item) => item === value);
+}
+/** Where Claude Code registers the plugin: the marketplace name and the plugin's name inside it. */
+const MARKETPLACE = "dw-sdlc";
+const PLUGIN = "guardrails";
+/** The plugin's link to the dw-sdlc package, which carries the schema. */
+const PACKAGE_LINK = "dw-sdlc";
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function git(root, args) {
+    const result = spawnSync("git", ["-C", root, ...args], { encoding: "utf8" });
+    return result.status === 0 ? result.stdout.trim() : undefined;
+}
+/** The committed layer when it is valid; an absent or invalid one sets nothing, as the resolver drops it. */
+function committedConfig(root) {
+    const path = join(root, COMMITTED_FILE);
+    if (!existsSync(path)) {
+        return {};
+    }
+    const result = validateDocument(COMMITTED_FILE, readFileSync(path, "utf8"));
+    return "value" in result ? result.value : {};
+}
+/**
+ * What the machine's layer points `$schema` at: the schema in the marketplace's clone as a `file://`
+ * URL, since the `$id` sits in a private repository an editor cannot fetch. The clone keeps its path
+ * across plugin updates, where the install cache moves with every version. No registered clone
+ * holding the schema falls back to the `$id`.
+ */
+export function schemaReference(claudeDir) {
+    const registry = readJson(join(claudeDir, "plugins", "known_marketplaces.json"));
+    const entry = isObject(registry) ? registry[MARKETPLACE] : undefined;
+    const clone = isObject(entry) && typeof entry.installLocation === "string" ? entry.installLocation : undefined;
+    if (clone === undefined) {
+        return schemaId();
+    }
+    const manifest = readJson(join(clone, ".claude-plugin", "marketplace.json"));
+    const plugins = isObject(manifest) && Array.isArray(manifest.plugins) ? manifest.plugins : [];
+    const plugin = plugins.find((item) => isObject(item) && item.name === PLUGIN);
+    if (plugin === undefined || typeof plugin.source !== "string") {
+        return schemaId();
+    }
+    const schema = join(clone, plugin.source, PACKAGE_LINK, SCHEMA_FILE);
+    return existsSync(schema) ? pathToFileURL(schema).href : schemaId();
+}
+/** The convention a local file pins, when it is one the setup writes: a run without `--convention` keeps it. */
+function pinnedConvention(existing) {
+    const commit = isObject(existing) ? existing.commit : undefined;
+    const value = isObject(commit) ? commit.convention : undefined;
+    return typeof value === "string" && isConvention(value) ? value : undefined;
+}
+/**
+ * The `guardrails` block a local file holds, carried through on every run, `--force` included: the
+ * resolver lets the local layer only tighten, so carrying the block never loosens a guardrail.
+ */
+function keptGuardrails(existing) {
+    return isObject(existing) && isObject(existing.guardrails) ? existing.guardrails : undefined;
+}
+/**
+ * A layer without the keys the setup owns: `$schema`, which moves with the clone, a pinned
+ * convention, which `--convention` may replace, and a `guardrails` object, which the setup carries
+ * and the flags pin keys in. Everything left is someone's content.
+ */
+function unowned(layer) {
+    const { $schema: _schema, commit, guardrails, ...other } = layer;
+    const rest = guardrails === undefined || isObject(guardrails) ? other : { ...other, guardrails };
+    if (!isObject(commit) || pinnedConvention(layer) === undefined) {
+        return commit === undefined ? rest : { ...rest, commit };
+    }
+    const { convention: _pinned, ...otherCommit } = commit;
+    return Object.keys(otherCommit).length === 0 ? rest : { ...rest, commit: otherCommit };
+}
+/**
+ * The guardrails block to write: the one the file holds, with the keys the flags pin. A pin less
+ * strict than the committed config's value is a loosening the resolver would drop the whole layer
+ * for, so it comes back as a refusal instead.
+ */
+function pinnedGuardrails(kept, committed, options) {
+    const base = { ...DEFAULT_GUARDRAILS, ...committed.guardrails };
+    const pins = [
+        ["--force-push", options.forcePush, STRICTNESS.forcePush, base.forcePush],
+        ["--commit-on-protected", options.commitOnProtected, STRICTNESS.commitOnProtected, base.commitOnProtected]
+    ];
+    for (const [flag, value, order, current] of pins) {
+        if (value !== undefined && order.indexOf(value) > order.indexOf(current)) {
+            return {
+                refusal: `${flag} ${value} loosens '${current}' from ${COMMITTED_FILE}; the local layer may only tighten it`
+            };
+        }
+    }
+    const guardrails = { ...kept };
+    if (options.forcePush !== undefined) {
+        guardrails.forcePush = options.forcePush;
+    }
+    if (options.commitOnProtected !== undefined) {
+        guardrails.commitOnProtected = options.commitOnProtected;
+    }
+    return { guardrails: Object.keys(guardrails).length === 0 ? kept : guardrails };
+}
+/** The same layer apart from what the setup owns. */
+function sameContent(existing, config) {
+    return isObject(existing) && render(unowned(existing)) === render(unowned(config));
+}
+/**
+ * The machine's layer: what inference finds, minus every key the committed config already sets, plus
+ * the `guardrails` block the file already holds. The local layer outranks the committed one, so an
+ * inferred key written here would override it. The commit convention is written only when one is
+ * asked for, by `--convention` or by the pin the file already holds: inference always gives the
+ * `conventional` default, and pinning it here overrides a convention the repository commits later,
+ * so that is a choice, never a guess.
+ */
+function localConfig(root, claudeDir, convention, guardrails) {
+    const inferred = inferConfig(root);
+    const committed = committedConfig(root);
+    const config = { $schema: schemaReference(claudeDir) };
+    const managers = { ...inferred.packageManagers };
+    if (committed.packageManagers?.node !== undefined) {
+        delete managers.node;
+    }
+    if (Object.keys(managers).length > 0) {
+        config.packageManagers = managers;
+    }
+    if (guardrails !== undefined) {
+        config.guardrails = guardrails;
+    }
+    if (convention !== undefined) {
+        config.commit = { convention };
+    }
+    return config;
+}
+function union(existing, additions) {
+    const list = Array.isArray(existing) ? existing.filter((item) => typeof item === "string") : [];
+    for (const rule of additions) {
+        if (!list.includes(rule)) {
+            list.push(rule);
+        }
+    }
+    return list;
+}
+function readJsonText(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readJson(path) {
+    if (!existsSync(path)) {
+        return undefined;
+    }
+    const parsed = readJsonText(readFileSync(path, "utf8"));
+    return isObject(parsed) ? parsed : "invalid";
+}
+function render(value) {
+    return JSON.stringify(value, null, 2) + "\n";
+}
+class Writer {
+    steps = [];
+    dryRun;
+    constructor(dryRun) {
+        this.dryRun = dryRun;
+    }
+    /** Writes when the text differs from what is on disk; records the outcome under `label`. */
+    put(label, path, text) {
+        const current = existsSync(path) ? readFileSync(path, "utf8") : undefined;
+        if (current === text) {
+            this.steps.push({ file: label, outcome: "unchanged" });
+            return;
+        }
+        if (!this.dryRun) {
+            mkdirSync(dirname(path), { recursive: true });
+            writeFileSync(path, text);
+        }
+        this.steps.push({ file: label, outcome: "wrote" });
+    }
+    refuse(label, detail) {
+        this.steps.push({ file: label, outcome: "refused", detail });
+    }
+}
+/** Where the repository's files live: the main checkout for a linked worktree. */
+function mainCheckout(root) {
+    const common = git(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+    if (common === undefined) {
+        return { checkout: root, gitDir: join(root, ".git") };
+    }
+    return { checkout: dirname(common), gitDir: common };
+}
+export function setup(options) {
+    const writer = new Writer(options.dryRun);
+    const root = repositoryRoot(options.root);
+    const { checkout, gitDir } = mainCheckout(root);
+    const claudeDir = options.claudeDir ?? join(options.home, ".claude");
+    // 1. The local config, from inference, the convention (the flag's, else the one the file pins) and
+    // the guardrails block the file holds, with the keys the flags pin.
+    const localPath = join(checkout, LOCAL_FILE);
+    const localCurrent = existsSync(localPath) ? readFileSync(localPath, "utf8") : undefined;
+    const existing = localCurrent === undefined ? undefined : readJsonText(localCurrent);
+    const convention = options.convention ?? pinnedConvention(existing);
+    const pinned = pinnedGuardrails(keptGuardrails(existing), committedConfig(checkout), options);
+    if ("refusal" in pinned) {
+        writer.refuse(LOCAL_FILE, pinned.refusal);
+    }
+    else {
+        const local = localConfig(checkout, claudeDir, convention, pinned.guardrails);
+        if (localCurrent !== undefined && !sameContent(existing, local) && !options.force) {
+            writer.refuse(LOCAL_FILE, "exists with other content; pass --force to overwrite it");
+        }
+        else {
+            writer.put(LOCAL_FILE, localPath, render(local));
+        }
+    }
+    // 2. The exclude entries, appended to whatever the file holds.
+    const excludePath = join(gitDir, "info", "exclude");
+    const excludeText = existsSync(excludePath) ? readFileSync(excludePath, "utf8") : "";
+    const lines = excludeText.split("\n");
+    const missing = [LOCAL_FILE, ".claude/settings.local.json"].filter((entry) => !lines.includes(entry));
+    const excludeLabel = relative(checkout, excludePath).startsWith("..") ? excludePath : relative(checkout, excludePath);
+    if (missing.length === 0) {
+        writer.steps.push({ file: excludeLabel, outcome: "unchanged" });
+    }
+    else {
+        const separator = excludeText === "" || excludeText.endsWith("\n") ? "" : "\n";
+        writer.put(excludeLabel, excludePath, excludeText + separator + missing.join("\n") + "\n");
+    }
+    // 3. The repository's deny rules, merged into the main checkout's local settings.
+    const localSettingsPath = join(checkout, ".claude", "settings.local.json");
+    const localSettings = readJson(localSettingsPath);
+    if (localSettings === "invalid") {
+        writer.refuse(".claude/settings.local.json", "is not a JSON object; fix it by hand first");
+    }
+    else {
+        const settings = localSettings ?? {};
+        const permissions = isObject(settings.permissions) ? settings.permissions : {};
+        const deny = union(permissions.deny, repositoryDeny(root)).filter((rule) => !RETIRED_DENY.includes(rule));
+        settings.permissions = { ...permissions, deny };
+        writer.put(".claude/settings.local.json", localSettingsPath, render(settings));
+    }
+    // 4. The user file: the lease exception, "$defaults" kept, and the irreversible non-git set.
+    const userPath = join(claudeDir, "settings.json");
+    const userLabel = options.claudeDir === undefined ? "~/.claude/settings.json" : userPath;
+    const userSettings = readJson(userPath);
+    if (userSettings === "invalid") {
+        writer.refuse(userLabel, "is not a JSON object; fix it by hand first");
+    }
+    else {
+        const settings = userSettings ?? {};
+        const autoMode = isObject(settings.autoMode) ? settings.autoMode : {};
+        // A list the user wrote without "$defaults" replaced the built-ins on purpose; only a new list
+        // gets the literal.
+        const allow = Array.isArray(autoMode.allow) ? union(autoMode.allow, [LEASE_RULE]) : ["$defaults", LEASE_RULE];
+        settings.autoMode = { ...autoMode, allow };
+        const permissions = isObject(settings.permissions) ? settings.permissions : {};
+        settings.permissions = { ...permissions, deny: union(permissions.deny, GLOBAL_DENY) };
+        writer.put(userLabel, userPath, render(settings));
+    }
+    return writer.steps;
+}
+function fail(message, code) {
+    console.error(`guardrails:setup: ${message}`);
+    process.exit(code);
+}
+export function run(argv) {
+    let values;
+    try {
+        values = parseArgs({
+            args: argv,
+            options: {
+                help: { type: "boolean", short: "h" },
+                root: { type: "string" },
+                home: { type: "string" },
+                convention: { type: "string" },
+                "force-push": { type: "string" },
+                "commit-on-protected": { type: "string" },
+                force: { type: "boolean" },
+                "dry-run": { type: "boolean" }
+            }
+        }).values;
+    }
+    catch (error) {
+        fail(`${error instanceof Error ? error.message : String(error)}\n\n${USAGE}`, 2);
+    }
+    if (values.help === true) {
+        console.log(USAGE);
+        return 0;
+    }
+    if (values.convention !== undefined && !isConvention(values.convention)) {
+        fail(`--convention must be ${COMMIT_CONVENTIONS.join(" or ")}, not '${values.convention}'\n\n${USAGE}`, 2);
+    }
+    const forcePush = values["force-push"];
+    if (forcePush !== undefined && !isForcePush(forcePush)) {
+        fail(`--force-push must be ${STRICTNESS.forcePush.join(", ")}, not '${forcePush}'\n\n${USAGE}`, 2);
+    }
+    const commitOnProtected = values["commit-on-protected"];
+    if (commitOnProtected !== undefined && !isCommitOnProtected(commitOnProtected)) {
+        fail(`--commit-on-protected must be ${STRICTNESS.commitOnProtected.join(" or ")}, not '${commitOnProtected}'\n\n${USAGE}`, 2);
+    }
+    const steps = setup({
+        root: values.root ?? process.cwd(),
+        home: values.home ?? homedir(),
+        claudeDir: values.home === undefined ? process.env.CLAUDE_CONFIG_DIR : undefined,
+        force: values.force === true,
+        dryRun: values["dry-run"] === true,
+        convention: values.convention,
+        forcePush,
+        commitOnProtected
+    });
+    for (const step of steps) {
+        const verb = step.outcome === "wrote" && values["dry-run"] === true ? "would write" : step.outcome;
+        console.log(`${verb.padEnd(11)} ${step.file}${step.detail === undefined ? "" : ` — ${step.detail}`}`);
+    }
+    return steps.some((step) => step.outcome === "refused") ? 1 : 0;
+}

package/dist/json-schema.d.ts

@@ -0,0 +1,8 @@
+export type SchemaProblem = {
+    path: string;
+    message: string;
+};
+export declare class SchemaError extends Error {
+}
+/** Every problem in `value` against `schema`, in schema order; empty when it validates. */
+export declare function validate(schema: unknown, value: unknown): SchemaProblem[];

package/dist/json-schema.js

@@ -0,0 +1,227 @@
+// The subset of JSON Schema draft 2020-12 the shipped schemas use, validated without a dependency: Node
+// has no validator built in, and a config file does not justify pulling one in. A keyword outside the
+// subset throws instead of passing silently, so a schema never promises more than this file enforces.
+// `format` is enforced, not annotative: `regex` is the one format, compiled with `RegExp` and refused
+// when it holds a construct POSIX ERE lacks, because `grep -E` runs the pattern and BSD and GNU grep
+// read those differently. `enum` and `const` compare by JSON text, exact for the scalars and arrays
+// the schemas use.
+export class SchemaError extends Error {
+}
+const ANNOTATIONS = new Set(["$schema", "$id", "$comment", "title", "description", "default", "examples"]);
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function show(value) {
+    return value === undefined ? "undefined" : JSON.stringify(value);
+}
+function sameJson(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+function at(path) {
+    return path === "" ? "(root)" : path;
+}
+function child(path, key) {
+    return path === "" ? key : `${path}.${key}`;
+}
+function operandMust(condition, path, keyword, expectation) {
+    if (!condition) {
+        throw new SchemaError(`${at(path)}: ${keyword} must be ${expectation}`);
+    }
+}
+function typeMatches(value, type, path) {
+    switch (type) {
+        case "object":
+            return isObject(value);
+        case "array":
+            return Array.isArray(value);
+        case "string":
+            return typeof value === "string";
+        case "number":
+            return typeof value === "number";
+        case "integer":
+            return Number.isInteger(value);
+        case "boolean":
+            return typeof value === "boolean";
+        case "null":
+            return value === null;
+        default:
+            throw new SchemaError(`${at(path)}: unknown type ${show(type)}`);
+    }
+}
+// A pattern read token by token: a bracket expression, where `(`, `?` and a backslash are plain
+// characters and a class such as `[:alpha:]` does not close it, an escape, a `(?`, or any one character.
+const ERE_TOKEN = /\[\^?\]?(?:\[:[a-z]+:\]|[^\]])*\]|\\[\s\S]|\(\?|[\s\S]/g;
+const NON_ERE_TOKEN = /^(\\[dDsSwWbB]|\(\?)$/;
+/** The first `\d`, `\s`, `\w`, `\b`, capital twin or `(?` outside a bracket expression. */
+function notEre(value) {
+    return Array.from(value.matchAll(ERE_TOKEN), ([token]) => token).find((token) => NON_ERE_TOKEN.test(token));
+}
+function compile(value) {
+    try {
+        return new RegExp(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Every problem in `value` against `schema`, in schema order; empty when it validates. */
+export function validate(schema, value) {
+    const problems = [];
+    check(schema, value, "", problems);
+    return problems;
+}
+function check(schema, value, path, problems) {
+    if (schema === true) {
+        return;
+    }
+    if (schema === false) {
+        problems.push({ path, message: "is not allowed here" });
+        return;
+    }
+    if (!isObject(schema)) {
+        throw new SchemaError(`${at(path)}: a schema must be an object or a boolean`);
+    }
+    for (const [keyword, operand] of Object.entries(schema)) {
+        checkKeyword(schema, keyword, operand, value, path, problems);
+    }
+}
+function checkKeyword(schema, keyword, operand, value, path, problems) {
+    switch (keyword) {
+        case "type": {
+            const types = Array.isArray(operand) ? operand : [operand];
+            if (!types.some((type) => typeMatches(value, type, path))) {
+                problems.push({ path, message: `expected ${types.join(" or ")}, got ${show(value)}` });
+            }
+            return;
+        }
+        case "enum": {
+            operandMust(Array.isArray(operand), path, keyword, "an array");
+            const members = Array.isArray(operand) ? operand : [];
+            if (!members.some((member) => sameJson(member, value))) {
+                problems.push({ path, message: `${show(value)} is not one of ${members.map(show).join(", ")}` });
+            }
+            return;
+        }
+        case "const": {
+            if (!sameJson(operand, value)) {
+                problems.push({ path, message: `${show(value)} is not ${show(operand)}` });
+            }
+            return;
+        }
+        case "properties": {
+            operandMust(isObject(operand), path, keyword, "an object");
+            if (!isObject(operand) || !isObject(value)) {
+                return;
+            }
+            for (const [key, subschema] of Object.entries(operand)) {
+                if (Object.hasOwn(value, key)) {
+                    check(subschema, value[key], child(path, key), problems);
+                }
+            }
+            return;
+        }
+        case "required": {
+            operandMust(Array.isArray(operand) && operand.every((key) => typeof key === "string"), path, keyword, "string[]");
+            if (!Array.isArray(operand) || !isObject(value)) {
+                return;
+            }
+            for (const key of operand) {
+                if (!Object.hasOwn(value, String(key))) {
+                    problems.push({ path, message: `missing required key ${show(key)}` });
+                }
+            }
+            return;
+        }
+        case "additionalProperties": {
+            if (!isObject(value)) {
+                return;
+            }
+            const declared = isObject(schema.properties) ? schema.properties : {};
+            for (const [key, member] of Object.entries(value)) {
+                if (Object.hasOwn(declared, key)) {
+                    continue;
+                }
+                if (operand === false) {
+                    problems.push({ path, message: `unknown key ${show(key)}` });
+                }
+                else if (operand !== true) {
+                    check(operand, member, child(path, key), problems);
+                }
+            }
+            return;
+        }
+        case "items": {
+            if (Array.isArray(value)) {
+                value.forEach((element, index) => check(operand, element, `${path}[${index}]`, problems));
+            }
+            return;
+        }
+        case "uniqueItems": {
+            if (operand !== true || !Array.isArray(value)) {
+                return;
+            }
+            const seen = new Set();
+            for (const element of value) {
+                const text = JSON.stringify(element);
+                if (seen.has(text)) {
+                    problems.push({ path, message: `duplicate item ${text}` });
+                }
+                seen.add(text);
+            }
+            return;
+        }
+        case "minItems": {
+            operandMust(typeof operand === "number", path, keyword, "a number");
+            if (Array.isArray(value) && typeof operand === "number" && value.length < operand) {
+                const noun = value.length === 1 ? "item" : "items";
+                problems.push({ path, message: `has ${value.length} ${noun}, needs at least ${operand}` });
+            }
+            return;
+        }
+        case "minLength": {
+            operandMust(typeof operand === "number", path, keyword, "a number");
+            if (typeof value !== "string" || typeof operand !== "number" || value.length >= operand) {
+                return;
+            }
+            const message = operand === 1 ? "must not be empty" : `${show(value)} is shorter than ${operand} characters`;
+            problems.push({ path, message });
+            return;
+        }
+        case "pattern": {
+            operandMust(typeof operand === "string", path, keyword, "a string");
+            if (typeof value === "string" && typeof operand === "string" && !new RegExp(operand).test(value)) {
+                problems.push({ path, message: `${show(value)} does not match /${operand}/` });
+            }
+            return;
+        }
+        case "format": {
+            operandMust(operand === "regex", path, keyword, '"regex", the one format enforced here');
+            if (typeof value !== "string") {
+                return;
+            }
+            const construct = notEre(value);
+            if (compile(value) === undefined) {
+                problems.push({ path, message: `${show(value)} is not a valid regular expression` });
+            }
+            else if (construct !== undefined) {
+                problems.push({
+                    path,
+                    message: `${show(value)} uses ${construct}, which POSIX ERE lacks; grep -E runs the pattern`
+                });
+            }
+            return;
+        }
+        case "minimum": {
+            operandMust(typeof operand === "number", path, keyword, "a number");
+            if (typeof value === "number" && typeof operand === "number" && value < operand) {
+                problems.push({ path, message: `${show(value)} is below the minimum ${operand}` });
+            }
+            return;
+        }
+        default: {
+            if (!ANNOTATIONS.has(keyword)) {
+                throw new SchemaError(`${at(path)}: unsupported keyword ${show(keyword)}`);
+            }
+        }
+    }
+}

package/dist/markdown.d.ts

@@ -0,0 +1,19 @@
+export type Heading = {
+    level: number;
+    text: string;
+    anchor: string;
+    line: number;
+};
+export type Row = {
+    cells: string[];
+    line: number;
+};
+/** Every ATX heading in `text`, a repeated anchor numbered `-1`, `-2` as GitHub numbers it. */
+export declare function headings(text: string): Heading[];
+/**
+ * The body rows of the tables in the section under the heading whose text is `title`, up to the next
+ * heading of its level or above; empty when there is no such heading.
+ */
+export declare function tableRows(text: string, title: string): Row[];
+/** Every backticked span in `text`, without its backticks. */
+export declare function codeSpans(text: string): string[];